CyberRota Analysis
AI-GeneratedThe vulnerability in PraisonAI allows an attacker to exploit the spider_tools._host_is_blocked() function, which improperly validates hostnames, enabling access to internal HTTP services through maliciously crafted hostnames like 127.0.0.1.nip.io. This could lead to unauthorized access to sensitive internal resources, posing a significant risk to organizations using affected versions prior to 1.6.58. Users of PraisonAI should prioritize upgrading to version 1.6.58 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.